Domain comming from Multiple IPS

[whizadree]

Hi there i keep getting reports from mail deamons that my email domain is posting spam , however they are using my domain but not my server , as far as i can see , now i keep getting 100's of reports of deliveries / not delivered messages , ive included headers of one of my reports ( I own timehub.com btw )

X-Originating-IP: [121.155.33.245]

Return-Path: <asimmunirxq[at]timehub.com>

Authentication-Results: mta137.mail.re4.yahoo.com from=timehub.com; domainkeys=neutral (no sig)

Received: from 121.155.33.245 (HELO timehub.com) (121.155.33.245)

by mta137.mail.re4.yahoo.com with SMTP; Fri, 29 Dec 2006 00:27:01 -0800

Message-ID: <524a01c72af0$1c6c84a0$c7f0d334[at]asimmunirxq>

From: "Kortney Simpson" <asimmunirxq[at]timehub.com>

To: "Sanora Henderson" <maha_widy[at]yahoo.com>

Cc: "Tiera" <yahoo.comcjhosmmppfy[at]yahoo.com>,

"Jeffrey Johnson" <ksmanvy2003[at]yahoo.com>,

"Ronna" <kamikkyle[at]yahoo.com>,

"Kanesha Knight" <momma47[at]yahoo.com>

Subject: Still got it huh

Date: Fri, 29 Dec 2006 02:21:56 -0600

MIME-Version: 1.0

Content-Type: multipart/related;

type="multipart/alternative";

boundary="----=_NextPart_C01_5DC7_73CFCA2C.5EC73F1B"

X-Priority: 3

X-MSMail-Priority: Normal

X-Mailer: Microsoft Outlook Express 5.50.4522.1200

X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200

This is a multi-part message in MIME format.

------=_NextPart_C01_5DC7_73CFCA2C.5EC73F1B

heres another header

from a different ip

Return-Path: <asimmunirnon[at]timehub.com>

Received: (qmail 51210 invoked by uid 3128); 29 Dec 2006 07:10:50 -0000

Received: from 124.129.79.98 by host476.ipowerweb.com (envelope-from <asimmunirnon[at]timehub.com>, uid 1002) with qmail-scanner-1.25st

(clamdscan: 0.88/1245. spamassassin: 3.1.0. perlscan: 1.25st.

Clear:RC:0(124.129.79.98):SA:1(6.8/5.0):.

Processed in 13.758357 secs); 29 Dec 2006 07:10:50 -0000

X-spam-Status: Yes, hits=6.8 required=5.0

X-spam-Level: ++++++

Received: from unknown (HELO timehub.com) (124.129.79.98)

by host476.ipowerweb.com with SMTP; 29 Dec 2006 07:10:36 -0000

Message-ID: <867601c72b1e$e30f1c20$a2b9e860[at]asimmunirnon>

Reply-To: "Juli" <asimmunirnon[at]timehub.com>

From: "Juli" <asimmunirnon[at]timehub.com>

-----

the list goes on and on

does anyone know how this is happening

and also how to get it solved

2 concerns are , they are using my domain and that i get the end results delivered back to me....

[Wazoo]

You are asking a FAQ ....

You have made no mention of a SpamCop.net Parsing and Reporting issue.

Moving to the Lounge with this post.

[dbiel]

2 concerns are , they are using my domain and that i get the end results delivered back to me....

Unfortunately welcome to the real world complements of spammers.

You may want to look at http://forum.spamcop.net/scwik/Bounce

[bobbear]

<snip>does anyone know how this is happening and also how to get it solved <snip>

It's happening because spammers are forging your domain as a bogus email address in the headers from & return path fields. A spamcop report would ignore that completely & anyone with any basic knowledge would know that you are not originating it. With that example the spamcop parser should pick up that it has come from a Kornet IP (121.155.33.245) and return abuse reports to there, not that it would do any good.

There's absolutely nothing that you can do about it except hope that they move on to someone else before too long.